Disco — Malware Profile

Disco is a custom implant that has been used by MoustachedBouncer since at least 2020 including in campaigns using targeted malicious content injection for initial access and command and control.

MITRE ATT&CK techniques (5)

• T1053.005 Scheduled Task
• T1071.002 File Transfer Protocols
• T1105 Ingress Tool Transfer
• T1204.002 Malicious File
• T1659 Content Injection

Attributed threat actors

• MoustachedBouncer

Read the full analysis on IntelFusions